CVE-2026-71239
Received Received - Intake

Django Template Injection in DjangoCRM Massmail Module

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template() call; email_creators.py passes eml_message.subject directly as a template string to Template(); and helpers.py contains the same f-string interpolation pattern. An authenticated user with mass-mail message edit rights can inject Django template syntax ({{ }} / {% %}) that executes at render time, enabling disclosure of other users' data and password hashes via request context variables, CSRF token forgery, and inclusion of arbitrary registered templates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-06
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71239
EUVD
EUVD-2026-53312

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
django_crm django_crm From 6.0 (inc) to 3.12.0 (inc)
django django *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in DjangoCRM's massmail module allows authenticated users with edit rights to inject Django template syntax into email subject and content fields. The flaw occurs because user-controlled input is rendered without sanitization through Django's Template() constructor in multiple locations like message_previews.py, email_creators.py, and helpers.py.

Detection Guidance

Check DjangoCRM's massmail module for user-controlled EmlMessage fields (subject, content) rendered via Django's Template() constructor without sanitization. Look for f-string embeddings in message_previews.py, email_creators.py, and helpers.py that pass message.subject/message.content directly to Template().

Impact Analysis

An attacker could exploit this to access other users' data and password hashes, forge CSRF tokens, or include arbitrary registered templates. This could lead to unauthorized data exposure, account compromise, or further attacks within the application.

Compliance Impact

This vulnerability likely violates GDPR's data protection principles by enabling unauthorized access to personal data and HIPAA's security requirements by exposing sensitive information like password hashes. It could result in non-compliance penalties and loss of trust.

Mitigation Strategies

Disable the massmail module if not in use. Apply input validation to EmlMessage fields to block Django template syntax ({{ }} / {% %}). Sanitize user-controlled data before passing to Template(). Update DjangoCRM to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart